confusion about lists always expanding.

I have something like 
 
(0)     ${if inlist{$local_part@$domain}{<,$acl_m_specialrcpts}}

It mostly works, but if $acl_m_specialrcpts which is tainted
contains a '$' I get a panic about expanding taited data, but only if
it contains a '$' - with no '$' there is no panic.

for example

localpart = any
domain = any.example.com
acl_m_specialrcpts = ${2+2}@test.com


Is that a bug? or should I just rewrite this as:

(1)     ${if inlist{$local_part@$domain}{<,\$acl_m_specialrcpts}}
   
which works as intended.


except actually 

acl_m_specialrcpts = ,${2+2}@test.com

and the expression is actually 

(3)     ${if {inlist{$local_part@$domain}{<,${substr{1}{$acl_m_specialrcpts}}}}}

so I guess I need to write that as: 

(4)     ${if inlist{$local_part@$domain}{<,\$\{substr\{1\}\{\$acl_m_specialrcpts\}\}}}
     
     
It seems almost easier to use forany  (it's longer but has fewer backslashes)

(5)     ${if forany{<,${substr{1}{$acl_m_specialrcpts}}}{eq{$item}{$local_part@$domain}}

which contrary to the documentation works as intended. (The documentation incorrectly suggests it will
perform the same as the first version (3) and thus only work sometimes)

Also should there be a warning about expanding tainted data when it
does not contain a '$'?

-- 
 Jasen.

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki